CVE-2026-19577 zephyrproject CVE debrief

Who should care

Network administrators and security teams responsible for managing and securing Zephyr-based systems should assess their exposure to this vulnerability and take necessary remediation steps.

Why it matters

CVE-2026-19577 is a high-severity vulnerability in Zephyr's IPv6 implementation that can be exploited by an unauthenticated attacker on the same link to potentially cause a denial-of-service (DoS) or information disclosure. Network administrators and security teams should assess their exposure and take necessary remediation steps.

• Potential denial-of-service (DoS) or information disclosure due to out-of-bounds read
• Verification of affected versions and patch application required
• Monitoring of network traffic for potential exploitation attempts necessary

Technical summary

The `net_route_ipv6_packet()` function in Zephyr's IPv6 implementation does not properly handle cases where the nexthop neighbor has no link-layer address. This can lead to an out-of-bounds read of approximately 2.5 KB past the end of an array. The vulnerability is reachable from the `ipv6_route_packet()` function, which is called for every received unicast IPv6 packet whose destination is not a local address on the receiving interface.

Defensive priority

High

Recommended defensive actions

• Review and apply the patch provided by the vendor
• Verify that the affected version of Zephyr is not in use
• Monitor network traffic for potential exploitation attempts
• Perform a thorough review of network configurations to ensure they are not exposed to the vulnerability
• Check for any existing compensating controls that could mitigate the vulnerability
• Inventory all assets that could be impacted and prioritize their remediation
• Track the status of remediation efforts and retest affected systems once patched

Evidence notes

The vulnerability is caused by the `net_route_ipv6_packet()` function not checking if the neighbor cache entry has a linked link-layer address before resolving it. This can lead to an out-of-bounds read of approximately 2.5 KB past the end of an array. The vulnerability is reachable from the `ipv6_route_packet()` function, which is called for every received unicast IPv6 packet whose destination is not a local address on the receiving interface.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.